An optical chip for self-testing quantum random number generation

Quantum Random Number Generators (QRNGs) are one of the most successful quantum technologies that have already found applications in consumer products. They generate random numbers through quantum phenomena. This has advantages with respect to its classical counterpart:¹ no stochastic model is needed to estimate the entropy of the device, a description of the quantum process suffices. Indeed, quantum phenomena are intrinsically probabilistic and can provide a certification of the output randomness just by detailing the physics of the phenomenon behind the experiment.

Following this idea, in the past few years, optical QRNGs have become the biggest family of QRNGs. In order to enforce their deployment in common life applications, many proposals of integrated QRNGs have appeared.^2–14 Integration improves the robustness of the QRNG mechanism against experimental errors but does not exclude a priori such errors, nor can assure that an adversary is classically or quantum correlated with the integrated system. In fact, one issue of QRNG is the degree of confidence that their output is due to the quantum process considered and not to some other foreseeable causes. The practice to differentiate between the true quantum randomness and the classical noise can be found in a complete description of the experiment. This means that all the devices in the QRNG must be fully characterized and completely trusted.

Interestingly, quantum physics offers the possibility to certify the quantum nature of the experiment with completely uncharacterized devices. However, this protocol, called Device-Independent (DI), requires the violation of a Bell inequality,^15–17 which results in very complex setups and very low bit generation rates. Alternatively, the semi-Device Independent (semi-DI or self-testing) approach allows having only a partial characterization of the device with a simple and easy implementation and performances comparable to existing fully characterized devices. In the past decade, there have been many demonstrations of semi-DI QRNGs.^18–30 

Here, we propose to apply the semi-DI protocol reported by Ref. 26 to the fully silicon integrated QRNG developed by Ref. 11 in order to realize an on-chip self-testing QRNG. This opens a very interesting perspective for future applications. In fact, on one side, the self-testing feature guarantees a higher level of security against possible experimental errors and classical attackers with respect to traditional QRNGs. On the other side, the chosen silicon-photonics platform is CMOS-compatible, which ensures that the device is easily integrable, can be mass produced, and is compatible with standard electronic circuitry. For these reasons, this integrated QRNG could offer a cheap, compact, and secure answer to the request of generating fresh random numbers to ensure secure communications for Internet of Things (IoT) devices. Following Ref. 26, the simplest way to model our QRNG is to consider it as composed by a preparation stage, the emitter, and a measurement one, the detector. The model considers that the source is partially characterized and generates one of two possible states ρ₁, ρ₂ with respect to an input variable x. On the contrary, the detector is left completely uncharacterized and it outputs a binary value b for each state sent by the emitter. The main assumption of the protocol is that the fidelity of the two states must be bounded and kept the same for each possible observer (the fidelity cannot decrease for the measurement device). If this quantity is small enough, independent of the nature of the quantum state (i.e., dimension and purity), the two states cannot be deterministically distinguished. This means that in the case of a perfect unambiguous state discrimination (USD) strategy, the inconclusive events must have a random occurrence; otherwise, a better strategy could be implemented and these events could be avoided.

Let us define now the fidelity $Fρ1,ρ2≔Trρ1ρ2ρ1$ for the two generated states ρ₁ and ρ₂, and then,

If we consider a case of an USD measurement, even in the limit in which the two states considered are pure, the probability of generating an inconclusive event is bounded by δ. In order to exploit the properties of the USD approach, the idea is to implement a measurement where the probability of having an error is minimized, i.e., ensuring $pb=¬x=0$⁠. From the estimated probabilities {p(b|x)}_b,x=0,1, the conditional min-entropy H_min(B|Λ) = −log₂(p_g(B|Λ)) can be bounded by a Semi-Definite Program (SDP),²⁶ where p_g(B|Λ) is the maximum probability of guessing the output string B knowing the value of the classical random variable Λ representing all possible strategies taken by the measurement device. This procedure takes into account possible deviations from the optimal USD strategy, which also consider sources of noise. This reduces the achievable H_min without affecting the security of the protocol. H_min quantifies the randomness of the generated sequence, representing the number of uniform random bits that we can extract from it.³¹ The extraction procedure is a well-known methodology in QRNG-technology³² and can be applied using algorithms such as Toeplitz matrix multiplication.³³ 

Here, we use the On-Off-Keying (OOK) version of the semi-DI protocol of Ref. 26. Depending on the value of the input variable x, the source is switched on (x = 1) or off (x = 0). We consider the off state $ρ0=00$ as the vacuum and the on state $ρ1=∑p(n)nn$ as a classical mixture of Fock’s states, where p(n) represents a super-Poissonian distribution, as shown in Ref. 34. In this case, the fidelity of the two generated states is given by the square-root of the probability to have a vacuum event p(0). Since the average value μ of this distribution is lower than 1, we can safely use the Poissonian estimate $e−μ2$ as a lower bound of such a quantity, given that p(n) has a higher variance by definition. In addition, this is confirmed by the experimental characterization of the source reported in Ref. 34. This allows us to write the following inequality:

which implies that it is sufficient to bound the mean photon number μ of ρ₁ to verify the assumption of the semi-DI protocol.

In this work, we use the fully integrated, low power, optical QRNG reported in Ref. 11. Briefly, the compact QRNG integrates one emitter and two detectors of photons, placed 20 μm apart. However, the QRNG protocol allows us to use only one of the two detectors. The emitter and the detector, both based on p–n junctions, share the same n-type episubstrate. The emitter is a mini silicon photomultiplier (SiPM), which emits photons during avalanche impact ionization.³⁵ The detector is an integrated passively quenched single photon avalanche diode (SPAD). The structure is compact, about 160 × 240 μm² [see Fig. 1(b)]. The 16 cells composing the SiPM emitter as well as the SPAD detectors are made with similar layout and with the same implantation steps. The emitter cells and the detector work in Geiger-mode and are passively quenched using integrated resistors. The emitter’s bias, typically operating well above the breakdown voltage, is settled much higher than the detector one. The breakdown voltage of the emitter and the detector is about 32.5 V at 20 °C. The chip and the readout electronics (Fig. 1) have been designed and produced in Fondazione Bruno Kessler (FBK) using the FBK NUV technology:³⁶ this technology ensures a low primary noise, a reduced correlated noise, and a particularly delayed cross-talk and after-pulsing, which could be limiting factors for the maximum bit rates and performance of the QRNG. The signal from the integrated SPAD detector is amplified, thresholded with a fast comparator, and digitalized (with monostable) by means of a custom front-end board, shown in Fig. 1(a). A voltage of −37 V is applied to the cathode of both the emitter and the detector. The voltage bias applied to the anode of the emitter, V_e, is controlled by an FPGA (Field Programmable Gate Array), which provides a pseudo-random transistor–transistor logic (TTL) signal at a fixed frequency of 1 MHz. The behavior of the emitter is directly controlled by the state of the TTL signal: the TTL 0/1 state corresponds to emission/no emission of photons, respectively, as the emitter is biased above/below the breakdown voltage. The value of V_e is controlled by the amplification and manipulation stage [AMS, see Fig. 1(a)], where the TTL signal is amplified and voltage shifted: by properly setting the offset voltage, the mean number of emitted photons μ per time interval is controlled. Note that the TTL logic is inverted with respect to the protocol (input variable x) due to the operation condition of the emitter (see Fig. 2). Finally, we stress that the emitter was initially designed to be driven with a constant voltage bias V_e: as a result, the pulsed mode introduces speed limitations in the generation of the random numbers. However, these can be easily overcome in the future implementations, e.g., by optimizing the overall efficiency of the device and by integrating the AMS. The self-testing protocol has been implemented using the fully integrated device by means of the experimental setup shown in Fig. 3.

As previously explained, the two key ingredients of the protocol are the conditional probability of observing or not a detection event given a certain input bit x, and the mean number of emitted photons μ per time interval used to bound the fidelity of the two states involved in the protocol. The experimental determination of the conditional probabilities is performed by the FPGA on the recorded traces (see Fig. 2). Each time a new x bit is applied to the emitter, the FPGA checks if one or more detection events have occurred in the same time window: if one or more photons have been revealed by the detector, the FPGA registers as output bit b = 1, while it registers b = 0 if no photon has been detected. Note that b = 1 is set also in the presence of counts due to noise, even if the source is OFF. The sequence of b’s constitutes the raw sequence of random numbers. For each sequence of numbers, the four conditional probabilities {p(b|x)}_b,x=0,1 are estimated and used in the SDP in order to find the conditional min-entropy H_min. H_min is certified by the protocol.²⁶ This holds as long as the mean photon number per pulse μ is known,²⁶ and therefore, during the experiment, μ is measured independently. An optical fiber with a large core diameter (600 μm, NA = 0.22) [see Fig. 3(b)] is placed on top of the integrated device and the collected photons detected by a commercial SPAD module. Calibration of μ is done for several constant bias voltages. The mean photon number per pulse on the monitor detector μ_mon is given by the number of detection events in 1 µs for each V_e. The efficiency of the monitor SPAD is estimated as η_mon = ∫η(λ)s(λ)dλ ≃ 60%, where η(λ) is the nominal wavelength-dependent detection efficiency of the SPAD and s(λ)³⁴ is the emission spectrum of the source. Then, knowing the optical transmission α ≃ 4% between fiber and SPAD, we obtain the mean number of photons emitted in the vertical direction and collected by the fiber (μ_v) by the relation

The characterization curve μ_v(V_e) reported in Fig. 4 (blue line) is finally extracted as an interpolation performed over the experimental data (orange dots). Since the semi-DI protocol is based on knowing this quantity, an oscilloscope is employed to continuously monitor the emitter voltage V_e. In this way, we are defining an upper-bound for μ_v that can be used to find the upper bound over the total mean photon number emitted by the source μ. The H_min is calculated using the conditional probabilities {p(b|x)}_b,x=0,1 and the relative value of μ.²⁶ However, the part of light reaching the detectors is only a fraction of the total amount emitted from the source. In order to factor out the loss due to the geometry of the device, we are going to consider the mean photon number of our states as the horizontally propagating part reaching the detectors μ_h. Therefore, we define k = μ_v/μ_h. k takes into account that the flux of photons collected by the optical fiber (μ_v) and the flux of photons that reaches the integrated SPAD in the device (μ_h) could differ. Now, we vary the power of the source, and we measure H_min and plot it as a function of μ_h for different values of k (Fig. 5). We obtain the typical bell shaped dependence for H_min as in Ref. 26. The assumption μ_v = μ_h, i.e., k = 1 (blue dots in Fig. 5), is conservative and fixes a lower bound to H_min. In this case, a maximum H_min = 0.61% ± 0.01% is observed for μ_h ≃ 0.4. Since the QRNG is working at a frequency of 1 MHz, this maximum value yields a certified quantum random number generation rate of 6 kHz (after extraction). Note that in this work, we focus only on the estimation of H_min and the extraction procedure is not performed.

Assume that k = 1 is a very rough approximation. In fact, if we consider the actual emitted spectrum s(λ),³⁴ all wavelengths shorter than 1.1 μm are severely attenuated by silicon absorption while propagating from the emitter to the detector in the integrated device. Let us estimate k based on some simple assumptions. First, we assume that only the photons emitted from the cells facing the SPAD detector contribute (i.e., only half of the total emission μ_v is contributing to μ_h), while the photons emitted by the others cells are entirely absorbed. This means that assuming k = 2, we can recalculate the minimum entropy H_min (orange dots in Fig. 5) and get a maximum of H_min = 0.99% ± 0.02%.

As a further step, we can consider a more realistic model where the 16 single emitting cells in the SiPM are treated as point emitters, which emit a spectrum described by s(λ). The emitted spectral photon flux per solid angle is assumed isotropic. The vertical and the horizontal photon fluxes are collected within two specific solid angles Ω_v and Ω_h and two different detection paths L_v(Ω_v) and L_h(Ω_h), respectively. For μ_v, we assume 16 equal cells. Other factors that determine the detected photon flux are the silicon absorption coefficient α(λ), the acceptance angle Ω_v of the fiber, and the transmission T(λ) through the silicon surface. For simplicity, we take its normal incidence value $T(λ)=1−nSi(λ)−1nSi(λ)+12$⁠, where n_Si is the refractive index of silicon. For μ_h, instead, we consider the spatial distribution of the SiPM cells with respect to the integrated SPAD [sum over i in Eq. (4)]. Therefore, we get the following estimate of k:

H_min estimated with this k value is shown as green dots in Fig. 5. Since the photon flux detected by the integrated SPAD is greatly reduced, we obtain a maximum value of H_min = 6.9% ± 0.1%. However, there is a trade-off between increasing the minimum entropy by introducing these assumptions and the overall security of the protocol itself, i.e., how much we can trust our hypothesis. In this sense, we can say that the estimation based on k = 1 is safer because it provides a lower bound to the entropy compared to all the other possible estimations for k > 1.

In summary, we have demonstrated a self-testing QRNG based on the semi-DI QRNG protocol described in Ref. 26. The method can be applied to our CMOS-compatible integrated optical chip, even if the specific chip structure is not optimized for the self-testing application. The maximum value of minimum entropy achieved is relatively small in the safer situation (<1% for k = 1), but it can be easily increased by introducing a new hypothesis on the model of the emitters or, even better, by improving the QRNG design to include a real time monitor of the generated photon flux. As for the clock rate, we have been limited by the amplification and manipulation stage to 1 MHz, since it introduces ripples at higher frequencies. However, the working frequency of an optimized structure could be increased, at least, up to around 20 MHz, which, with an optimized extraction rate of 5% (see Fig. 5), would correspond to a throughput of certified random bits of 1 MHz. Moreover, the rate could be significantly increased by multiplexing more QRNG in the same chip. Finally, the overall efficiency of the system can be improved by reducing the photon loss in the chip with a proper design. Having a more efficient photon transmission from the emitters to the detectors will lead to a decrease in the power needed to generate the certified string of quantum random numbers. The presented approach is of commercial interest, thanks to the low cost and the compactness of the chip, offering in addition a high level of security due to the semi-DI protocol.